sb-au logo
Story image

Zero-day Internet Explorer vulnerability exploited in the wild

25 Sep 2019

On September 23, Microsoft released an out-of-band patch for a zero-day vulnerability in Internet Explorer that has been exploited in the wild.

Exploiting the vulnerability gives an attacker the same privileges as the current user.

Tenable senior security response manager Satnam Narang shares his findings on the vulnerability.

Analysis

CVE-2019-1367 is a memory corruption vulnerability in Internet Explorer’s scripting engine in the way that objects in memory are handled.  

Exploitation of this vulnerability could result in the attacker gaining arbitrary code execution under the same privileges as the current user.

In the event that the current user has administrative privileges, an attacker could perform various actions on the system, from creating a new account with full privileges to installing programs or even modifying data.

To exploit the vulnerability, an attacker would have to host the exploit on a malicious website and socially engineer a user into opening that website in Internet Explorer.

In the case of a targeted attack, an attacker could include a link to the malicious website in an email or in a malicious email attachment (HTML file, PDF file, Microsoft Office document) that supports embedding the scripting engine content.

The vulnerability was discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG).

Earlier this year, Lecigne discovered and reported two zero-day vulnerabilities: a use-after-free vulnerability in Google Chrome (CVE-2019-5786) and an elevation of privilege vulnerability in Microsoft Windows (CVE-2019-0808) that were exploited together in the wild.

Additional details about the in-the-wild exploitation of this vulnerability have not yet been made public by Lecigne and Google’s TAG, though we anticipate such details will be disclosed in a blog post in the near future.

Solution

Microsoft released an out-of-band patch for this vulnerability due to the report that it has been exploited in the wild.

Please refer to the Security Updates section for additional information on the IE Cumulative Update or relevant Security Updates.

Additionally, Microsoft has provided workarounds for both 32-bit and 64-bit systems by restricting access to the JScript.dll file.

An administrator can do so by entering specific commands into the command prompt; the commands are available at the end of the Microsoft security advisory page.

However, these workarounds should only be used as a temporary measure until patching is feasible.

Commands to revert the workarounds are also available on the Microsoft security advisory page.

ESET cybersecurity specialist Jake Moore says, “The importance of patching has never been so important and not just for those ‘early adopters’.

“Luckily there is a minimal share of the public still using IE as a browser, but it’s worth noting this could still have damaging consequences.”

Trustwave SpiderLabs EMEA director Ed Williams says, “The release of this patch underlines the importance of regular patching on an environment.

“It also highlights the importance of regular asset identification and vulnerability scanning of environments, for example, knowing what to patch once a vulnerability has been identified.

“We know that attackers are flexible and dynamic and will be looking to further leverage this vulnerability to suit their needs, be it financial or otherwise.

“While Internet Explorer isn’t as popular as it once was, it is still a rich target for attackers, and with the release of this patch, further emphasises why it is a business risk when compared to other browsers.

Story image
Imperva unveils new data security platform built for cloud
"The cloud has revolutionised IT, offering organisations a strategic opportunity to rapidly pursue new market initiatives and adapt their operations in the face of new business challenges."More
Story image
Five things ANZ businesses should know about storing customers’ data
Businesses need to correlate events intelligently across multiple threat surfaces, application layers, and time spans to connect event A, to event B, to event C — even if they are months apart.More
Story image
Why a more secure organisation is a collective responsibility
With vast volumes of data moving to the cloud, many IT professionals are frequently challenged to protect their enterprise environment, and there is a greater focus being placed on advancing cybersecurity strategies.More
Story image
Remote work continues, and endpoint security cited as a must
Nearly half of workers will stay remote after the pandemic ends, and two out of three IT professionals are concerned with endpoint misuse, according to Prey Software's new study.More
Story image
Video: 10 Minute IT Jams - SonicWall VP on the cybersecurity lessons learned from the last 12 months
This is our seventh IT Jam with SonicWall, the cybersecurity company specialising in firewall, network security, cloud security and more.More
Story image
Fortinet: Hyperscaling networks? Hyperscale your security!
Jon McGettigan, Fortinet A/NZ Regional Director, explains why a broad, integrated and automated security fabric is the most effective strategy to protect users, apps and data in a hyperscaling environment.More